Life and Religion

No warrant, no problem

How the government can get your digital data

Published Monday, June 30, 2014 10:15 am

by Theodoric Meyer, ProPublica

The government isn’t allowed to wiretap American citizens without a warrant from a judge, but there are plenty of legal ways for law enforcement and other government officials to snoop on the telling digital trails you create every day.

Authorities can often obtain emails and texts without showing probable cause of a crime. These powers are entirely separate from the National Security Agency’s collection of Americans’ phone records en masse, which the House of Representatives voted to end last month.

Here’s a look at what the government can get from you and the legal framework behind its power:

Phone records

Listening to your phone calls without a judge’s warrant is illegal if you’re a U.S. citizen, but police don’t need a warrant to monitor the numbers for incoming and outgoing calls in real time, as well as the duration of the calls. The government can also get historical phone records with an administrative subpoena, which doesn’t require a judge’s approval.

Police can get phone records without a warrant thanks to a 1979 Supreme Court case, Smith v. Maryland, which found that the Constitution’s Fourth Amendment protection against unreasonable search and seizure doesn’t apply to a list of phone numbers. The Electronic Communications Privacy Act (ECPA) — a 1986 law that underpins much of how the government can get digital data — requires providers to allow access to real-time data with a court order and historical data with a subpoena.

Location data

Your cell phone is basically a tracker. Many cell phone carriers provide authorities with a phone’s location and may charge a fee for doing so. Cell towers track where your phone is at any moment; so can the GPS features in some smartphones.

In response to an inquiry by Sen. Edward J. Markey, a Massachusetts Democrat, Sprint reported that it provided location data to U.S. law enforcement 67,000 times in 2012. AT&T reported receiving 77,800 requests for location data in 2012. (AT&T also said that it charges $100 to start tracking a phone and $25 a day to keep tracking it.) Other carriers, including T-Mobile, U.S. Cellular and Verizon, didn’t specify the number of location data requests they had received or the number of times they’ve provided it.

Internet service providers can also provide location data that tracks users via their computer’s IP address — a unique number assigned to each computer.

Courts have been divided for years on whether police need a warrant from a judge to get cell phone location data. Back in 2005, Judge Stephen W. Smith denied a government request for real-time access to location data, and some judges have followed his lead. But other courts have ruled that no warrant in necessary.

Emails

Here’s where the rules get really complicated. Authorities need a warrant to get unopened emails that are less than 180 days old, but they can obtain opened email as well as unopened emails that are at least 180 days old with only a subpoena as long as they notify the customer whose email they’ve requested.

The government can also get older unopened emails without notifying the customer if they get a court order that requires them to offer “specific and articulable facts showing that there are reasonable grounds to believe” the emails are “relevant and material to an ongoing criminal investigation” — a higher bar than a subpoena.

Drafts are different. Communicating through draft emails, à la David Petraeus and Paula Broadwell, seems sneaky. But drafts are actually easier for investigators to get than recently sent emails because the law treats them differently.

The ECPA distinguishes gives stored electronic data — including draft emails that were never sent — less protection under the law. Authorities need only a court order or a subpoena to get them.

Texts

Investigators need only a court order or a subpoena, not a warrant, to get text messages that are at least 180 days old from a cell provider — the same standard as emails. Many carriers charge authorities a fee to provide texts and other information. Sprint charges $30 for access to a customer’s texts, according to documents obtained by the ACLU in 2012, while Verizon charges $50.

The ECPA also applies to text messages, which is why the rules are similar to those governing emails. But the ECPA doesn’t apply when it comes to reading texts or accessing other data on a physical cell phone rather than getting them from a carrier.

The Supreme Court recently ruled that police needed a warrant to search the phones of people who had been arrested. The court dismissed the Justice Department’s argument that searching a cell phone was not materially different than searching a wallet or a purse.

“That is like saying a ride on horseback is materially indistinguishable from a flight to the moon,” Chief Justice John G. Roberts Jr. wrote in the opinion.

Cloud data

Authorities typically need only a court order or a subpoena to get data from Google Drive, Dropbox, SkyDrive and other services that allow users to store data on servers, or “in the cloud,” as it’s known.

The law treats cloud data the same as draft emails — authorities don’t need a warrant to get it. But files that you’ve shared with others — say, a collaboration using Google Docs — might require a warrant under the ECPA if it’s considered “communication” rather than stored data.

Social media

When it comes to sites like Facebook, Twitter and LinkedIn, the rules depend on what authorities are after. Content is treated the same way as emails — unopened content less than 180 days old requires a warrant, while opened content and content at least 180 days old does not.

Authorities can get IP addresses from social networks the same way they get them from Internet service providers — with a court order showing the records are relevant to an investigation for real-time access, and with a subpoena for historical records.

Twitter says that “non-public information about Twitter users is not released except as lawfully required by appropriate legal process such as a subpoena, court order, or other valid legal process,” except in emergencies “involving the danger of death or serious physical injury to a person.”

Facebook says it requires a warrant from a judge to disclose a user’s “messages, photos, videos, wall posts, and location information.” But it will supply basic information, such as a user’s email address or the IP addresses of the computers from which someone recently accessed an account, under a subpoena.